http://www.guardian.co.uk/technology/2007/aug/23/guardianweeklytechnologysection.security
Monster hit by 'worst ever' trojan
Fake toolbar cripples jobseekers' PCs and steals personal data. Michael Pollitt reports
The Guardian
Thursday August 23 2007
Tom is a copywriter living in Los Angeles. He's desperately looking for a new job, so he signed up to Monster - the online careers and recruitment resource for employers and jobseekers. An email he believed was from Monster arrived, inviting him to download the new "Monster Job Seeker Tool". But Tom soon discovered that it was no such thing. Instead, he had fallen victim to the "worst ever" ransomware trojan that encrypted all his files and stole information.
"Hundreds of files, if not over 1,000, were encrypted," says Tom. He found messages in his folders from the Glamorous Team demanding $300 (£150) to decrypt his files and threatening to share his private information. A few days later, a friend pointed him towards Prevx, a UK-based internet security company which had written a free decryption tool.
File encryption
"Unfortunately, it seems my files were encrypted a few times over, so the tool didn't work for me. I never considered paying up. I would never run a program from these crooks on my machine - who knows what it would be. My big concern is their threat to share my personal info with the world," says Tom who, thanks to good backups, only lost recent family photographs.
Mike, a management consultant from Arizona, had been let go from his job, and was moving files from his company laptop so he could return it. "I noticed the "read_me.txt" files [with the ransom demand] on my 80GB external hard drive, and of course knew there was a problem. Thinking I was doing the right thing, I deleted all of the .txt files and copied my good files to DVDs. When I tried to read the DVD to make sure the files would open, my heart sank as I discovered that everything was trashed," says Mike.
"Of the 80GB of data, I would estimate that I permanently lost about half."
"This is the worst attack I've ever seen," says Jacques Erasmus, Prevx's director of malware research and a former hacker who has proved a worthy opponent for the Glamorous Team. He's spent days trying to help victims like Tom and Mike recover their files.
"We received a first sighting of this around eight hours after it was released via spearphished emails to a targeted audience of people looking for work using the monster.com website," says Erasmus. The attack may have used an email list stolen from Monster or a similar job-seeking service.
"[Normally] to get an uptake of 1,000 machines, you'd need to send the email to around 75,000 people. However, because this email was highly targeted, the conversion ratio would be much better. Therefore I believe it was sent to around 10,000 email addresses," says Erasmus. A secondary wave of infection involved pornography and a malicious website in Panama. Only people in the USA were affected, except for one person in Saudi Arabia.
The software was a password-stealer trojan with a new ransomware feature and three functions: encrypting files on the victim's hard disk; stealing browser data and silently sending out stolen information to a website on a shared Yahoo server. No documents were taken - just data from browser sessions - although panicked users who deleted the read_me.txt messages with the randomly generated encryption key lost their files forever.
A key component was an http sniffer, which captures user data from browser sessions by bypassing the SSL encryption - the lock icon - normally relied on for secure internet transactions. Every 60 seconds, stolen data was encrypted by the trojan and sent to a dump site created only days beforehand.
"It took us about six hours to reverse-engineer the [encryption] algorithm including testing," says Erasmus. "We made two tools, one to decrypt the stolen data and one to decrypt the files for users."
Helped by access to the dump site (possibly an oversight by the ransomware creators), Erasmus found that around 1,000 PCs had been infected. Apart from individuals at home, the victims included US government departments and multinationals including Hewlett-Packard. He found 257MB of stolen data and contacted the FBI and a dozen seriously affected companies.
The data proved startling in its detail. An employee of General Dynamics Corporation, working inside the US Department of Transportation, was monitored making his online passport application to the US Department of State. A woman working for Booz Allen Hamilton, a global consulting group, was seen applying for a job directly to the CIA. Although both were using secure browser connections, they now face identity theft from organised criminals.
"There was an entire biometric profile of a government contractor in the stolen data - details such as eye colour, hair colour, exact measurements and weight," says Erasmus. "What worried us more was the level of data that was compromised from large US corporations and government contractors. Logins to critical systems, databases and intranet logins were captured. This could be devastating."
Stolen data
The Guardian has seen 5.6m lines of stolen data including credit card and bank account numbers, home addresses, social security numbers, logins, passwords, job applications and even emails with sexual content. We quickly found logins for Mike in Arizona and Bill in Oregon. Using Bill's details, we logged into his email account and left a message. His view of the ransomware trojan now? "Very malicious, and dangerous, and very scary."
We sent Mike his login details for his Fuse.net email and Paypal accounts, discovering even more about the trojan's capabilities. "My first reaction, to put it bluntly, is holy shit!" says Mike.
It's even worse for other people. Stolen banking information, almost certainly sold on by the Glamorous Team, will delight cash-seeking criminals. "We believe that Glamorous Team are Russian and part of a bigger crime network," says Erasmus. Only Prevx (prevx.com) users were protected as its software works by stopping any suspicious behaviour rather than reacting to previously detected files.
Are we going to see such a well-targeted attack here in the UK? It's very likely, although the criminals are probably now lying low. "For what they have achieved, I'd need to give them high marks. They've got into the government, major defence contractors and major corporates in the USA," says Erasmus.
As a former hacker, Erasmus admires the criminals' technical skills and he urges people not to be fooled by odd-looking emails that could be phishing attacks.
The ransom note
Hello, your files are encrypted with RSA-4096 algorithm (en.wikipedia.org/wiki/RSA). You will need at least few years to decrypt these files without our software. All your private information for last 3 months were collected and sent to us. To decrypt your files you need to buy our software. The price is $300. To buy our software please contact us at: [email address] and provide us your personal code [personal code]. After successful purchase we will send your decrypting tool, and your private information will be deleted from our system. If you will not contact us until 07/15/2007 your private information will be shared and you will lost all your data.
